Reading list
The sources the framework leans on: the adjacent disciplines, the security and governance regimes, and the evidence behind the theses.
BROCS borrows more than it invents, and this page is the borrowing made explicit. Primary sources over commentary, free over paywalled wherever a free canonical exists, and each entry says which letters it feeds. If a claim on this site does not trace to something here or to a source in the failure-mode library, tell us and it will be sourced or cut.
The adjacent disciplines
BROCS borrows more than it invents. These are the bodies of work each letter leans on, and the fastest way to get strong at a letter is still to read its discipline.
Feeds B
DORA research program
The delivery-performance metrics BROCS borrows directly, lead time above all. Years of evidence that speed and stability are not a trade-off, which is also the right frame for AI enablement.
Google SRE books
Free, canonical, and still the best writing on error budgets, golden signals, toil, and being on call. The Observe and Run letters assume this vocabulary.
Feeds S
The FinOps Framework
Inform, optimise, operate. The cost half of Secure is FinOps applied to inference, and the framework transfers with one amendment: monthly is too slow.
Platform engineering community
The paved-road, platform-as-product school BROCS leans on hardest. If your organization has no platform practice, start here before starting with AI.
Security and governance
The Secure letter's homework. The first two are the references for what actually goes wrong; the second two are the regimes the evidence has to satisfy.
Feeds S
OWASP Top 10 for LLM Applications
The community consensus on LLM-specific failure classes: prompt injection, insecure output handling, excessive agency. The vocabulary your security review should be conducted in.
AI Incident Database
The closest thing the field has to an aviation-style incident registry. Several entries in the failure-mode library cite it; browsing it is a fast way to calibrate what actually happens versus what gets speculated about.
Feeds S
NIST AI Risk Management Framework
Govern, Map, Measure, Manage. Voluntary, widely referenced, and maps cleanly onto the surface: Map and Measure land on Observe, Manage on Control, Govern on Secure. Speak both vocabularies and audits get shorter.
Feeds S
EU AI Act (Regulation 2024/1689)
The primary text, not a summary. The operational consequence for engineering teams is record-keeping, which is the agent trace with a retention policy. The implementation-tracker at artificialintelligenceact.eu is the readable companion.
Evidence for the theses
The numbers and cases the site cites, so you can check the homework and reuse it in your own decks.
Cisco 2024 Data Privacy Benchmark Study
The shadow AI numbers: 48 percent of organizations admitted entering non-public company information into generative AI tools, 27 percent banned the tools at least temporarily. A survey of 2,600 privacy and security professionals.
Wiz Research: the exposed DeepSeek database
The reference case for vendor-side risk: over a million log lines, chat history, and API keys on an unauthenticated ClickHouse. What your builders send to an endpoint lands in someone's logs.
Feeds S
EchoLeak: zero-click prompt injection in production (arXiv:2509.10540)
The first documented zero-click prompt injection exploit in a production system, written up properly. The reason "untrusted content is an instruction channel" is a design constraint rather than a talking point.
Moffatt v. Air Canada, 2024 BCCRT 149
The tribunal decision itself: a company is liable for what its chatbot tells a customer. Short, readable, and the strongest single argument for a retrieval boundary that legal has ever handed engineering.